The oem unlock allows you run a custom OS (e.g. a custom Android build) that is not signed. This is well known, and is what allows this demo to work. However, t

The oem unlock allows you run a custom OS (e.g. a custom Android build) that is not signed. This is well known, and is what allows this demo to work. However, the comment I was making is whether the firmware (i.e. the bootloader, "BIOS" if you may - in particular the Secure OS) can be reflashed. The reason the existing firmware could be desired to be replaced is that the Secure OS component specifically disallows an OS to run in hypervisor mode (i.e. no KVM or Xen), or because of terrible bugs in HBOOT that cause hangs if the boot.img exceeds a certain arbitrary size (a few tens of MB). All these limitations mean that even an OEM-unlocked device is not quite entirely available to the mercy of a developer. Of course, the ability to reflash the low-level boot code is not very useful unless you have sources to build a better replacement.